Operating System Monitoring

Definition

The operating system software, for D3FEND's purposes, includes the kernel and its process management functions, hardware drivers, initialization or boot logic. It also includes and other key system daemons and their configuration. The monitoring or analysis of these components for unauthorized activity constitute **Operating System Monitoring**.

D3FEND ID: D3-OSM
Tactic: Detect
Certification relevance: CySA+GCIHGCIASecurity+

Sub-techniques

ATT&CK techniques it counters

D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.

29 techniques, 67 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 29 ATT&CK techniques above.

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

40 more in the full list